×
‘The Worst Leak That I’ve Witnessed’: U.S. Cybersecurity Agency Leaves Its Digital Keys Out in Public on GitHub
                The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has been leaving the digital keys to its own cloud storage accounts sitting out in the open, in plain text form, for some unknown amount of time, according to a report from Krebs on Security. The problem finally got fixed over the weekend, the report says. Surely the secret information was buried in some obscure folder with an inscrutable name, I hear you saying. The repository was reportedly named “Private-CISA.” But there’s no way the contents were that sensitive, you object. But the contents included passwords, keys, and tokens—and the passwords were plain text in a .CSV file. CISA gave a statement to Krebs, saying the following:  “Currently, there is no indication that any sensitive data was compromised as a result of this incident[…] While we hold our team members to the highest standards of integrity and operational awareness, we are working to ensure additional safeguards are implemented to prevent future occurrences.”  Since the repository was created in November of last year, the duration of the vulnerability seems to have been about six months—but it could have been much shorter depending on what information as added when.

 To refresh your memory, CISA is a relatively new branch of the Department of Homeland Security that has had an overall rough time during Trump 2.0, even though, by signing it into law in 2018, Trump actually midwifed CISA into existence during Administration 1.0, and sorry about the tangent, but Trump’s speech to mark the occasion was an exceptional example of Trump poetry, including excerpts like this one:

  “The cyber battlespace evolves — and it is evolving, and unfortunately, faster than a lot of people want to talk about. But battlespace it is. So as the cyber battlespace evolves, this new agency will ensure that we confront the full range of threats from nation-states, cyber criminals, and other malicious actors, of which there are many.”   Incontestably true, Mister President. Battlespace it is. Anyway, Trump was enraged by information provided by CISA leadership during the period between the 2020 election and January 6, 2021 when he was on a mission to have the election results overturned in his favor. He fired the CISA director he appointed, and since taking office again, his CISA has been a chaotic farce. Neither of the acting directors he’s appointed so far have been confirmed by the Senate, and Trump has recently sought to drastically cut CISA’s funding. Now, to add to CISA’s worries, it seems, according to one interpretation from the Krebs report on what was in the repository, an individual employee working for a government contractor called Nightwing was using Github to move material from a work device to a home device—sorta like emailing documents to yourself, but somehow even less secure than that.

 I’m no expert on federal Cybersecurity, but this from Krebs sounds like stuff we as citizens don’t want our government leaking:  “One of the exposed files, titled ‘importantAWStokens,’ included the administrative credentials to three Amazon AWS GovCloud servers. Another file exposed in their public GitHub repository — ‘AWS-Workspace-Firefox-Passwords.csv’ — listed plaintext usernames and passwords for dozens of internal CISA systems. According to Caturegli, those system[s] included one called ‘LZ-DSO,’ which appears short for ‘Landing Zone DevSecOps,’ the agency’s secure code development environment.”  Kreb’s source about the information left out in the open was Guillaume Valadon of GitGuardian, a company that scans GitHub for secrets, meaning his business is finding situations like this one. Valadon told Krebs it was “the worst leak that I’ve witnessed in my career.”      #Worst #Leak #Ive #Witnessed #U.S #Cybersecurity #Agency #Leaves #Digital #Keys #Public #GitHubCISA,Github,leaks

‘The Worst Leak That I’ve Witnessed’: U.S. Cybersecurity Agency Leaves Its Digital Keys Out in Public on GitHub‘The Worst Leak That I’ve Witnessed’: U.S. Cybersecurity Agency Leaves Its Digital Keys Out in Public on GitHub
                The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has been leaving the digital keys to its own cloud storage accounts sitting out in the open, in plain text form, for some unknown amount of time, according to a report from Krebs on Security. The problem finally got fixed over the weekend, the report says. Surely the secret information was buried in some obscure folder with an inscrutable name, I hear you saying. The repository was reportedly named “Private-CISA.” But there’s no way the contents were that sensitive, you object. But the contents included passwords, keys, and tokens—and the passwords were plain text in a .CSV file. CISA gave a statement to Krebs, saying the following:  “Currently, there is no indication that any sensitive data was compromised as a result of this incident[…] While we hold our team members to the highest standards of integrity and operational awareness, we are working to ensure additional safeguards are implemented to prevent future occurrences.”  Since the repository was created in November of last year, the duration of the vulnerability seems to have been about six months—but it could have been much shorter depending on what information as added when.

 To refresh your memory, CISA is a relatively new branch of the Department of Homeland Security that has had an overall rough time during Trump 2.0, even though, by signing it into law in 2018, Trump actually midwifed CISA into existence during Administration 1.0, and sorry about the tangent, but Trump’s speech to mark the occasion was an exceptional example of Trump poetry, including excerpts like this one:

  “The cyber battlespace evolves — and it is evolving, and unfortunately, faster than a lot of people want to talk about. But battlespace it is. So as the cyber battlespace evolves, this new agency will ensure that we confront the full range of threats from nation-states, cyber criminals, and other malicious actors, of which there are many.”   Incontestably true, Mister President. Battlespace it is. Anyway, Trump was enraged by information provided by CISA leadership during the period between the 2020 election and January 6, 2021 when he was on a mission to have the election results overturned in his favor. He fired the CISA director he appointed, and since taking office again, his CISA has been a chaotic farce. Neither of the acting directors he’s appointed so far have been confirmed by the Senate, and Trump has recently sought to drastically cut CISA’s funding. Now, to add to CISA’s worries, it seems, according to one interpretation from the Krebs report on what was in the repository, an individual employee working for a government contractor called Nightwing was using Github to move material from a work device to a home device—sorta like emailing documents to yourself, but somehow even less secure than that.

 I’m no expert on federal Cybersecurity, but this from Krebs sounds like stuff we as citizens don’t want our government leaking:  “One of the exposed files, titled ‘importantAWStokens,’ included the administrative credentials to three Amazon AWS GovCloud servers. Another file exposed in their public GitHub repository — ‘AWS-Workspace-Firefox-Passwords.csv’ — listed plaintext usernames and passwords for dozens of internal CISA systems. According to Caturegli, those system[s] included one called ‘LZ-DSO,’ which appears short for ‘Landing Zone DevSecOps,’ the agency’s secure code development environment.”  Kreb’s source about the information left out in the open was Guillaume Valadon of GitGuardian, a company that scans GitHub for secrets, meaning his business is finding situations like this one. Valadon told Krebs it was “the worst leak that I’ve witnessed in my career.”      #Worst #Leak #Ive #Witnessed #U.S #Cybersecurity #Agency #Leaves #Digital #Keys #Public #GitHubCISA,Github,leaks

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has been leaving the digital keys to its own cloud storage accounts sitting out in the open, in plain text form, for some unknown amount of time, according to a report from Krebs on Security. The problem finally got fixed over the weekend, the report says.

Surely the secret information was buried in some obscure folder with an inscrutable name, I hear you saying. The repository was reportedly named “Private-CISA.”

But there’s no way the contents were that sensitive, you object. But the contents included passwords, keys, and tokens—and the passwords were plain text in a .CSV file.

CISA gave a statement to Krebs, saying the following:

“Currently, there is no indication that any sensitive data was compromised as a result of this incident[…] While we hold our team members to the highest standards of integrity and operational awareness, we are working to ensure additional safeguards are implemented to prevent future occurrences.”

Since the repository was created in November of last year, the duration of the vulnerability seems to have been about six months—but it could have been much shorter depending on what information as added when.

To refresh your memory, CISA is a relatively new branch of the Department of Homeland Security that has had an overall rough time during Trump 2.0, even though, by signing it into law in 2018, Trump actually midwifed CISA into existence during Administration 1.0, and sorry about the tangent, but Trump’s speech to mark the occasion was an exceptional example of Trump poetry, including excerpts like this one:

“The cyber battlespace evolves — and it is evolving, and unfortunately, faster than a lot of people want to talk about. But battlespace it is. So as the cyber battlespace evolves, this new agency will ensure that we confront the full range of threats from nation-states, cyber criminals, and other malicious actors, of which there are many.” 

Incontestably true, Mister President. Battlespace it is.

Anyway, Trump was enraged by information provided by CISA leadership during the period between the 2020 election and January 6, 2021 when he was on a mission to have the election results overturned in his favor. He fired the CISA director he appointed, and since taking office again, his CISA has been a chaotic farce. Neither of the acting directors he’s appointed so far have been confirmed by the Senate, and Trump has recently sought to drastically cut CISAs funding.

Now, to add to CISA’s worries, it seems, according to one interpretation from the Krebs report on what was in the repository, an individual employee working for a government contractor called Nightwing was using Github to move material from a work device to a home device—sorta like emailing documents to yourself, but somehow even less secure than that.

I’m no expert on federal Cybersecurity, but this from Krebs sounds like stuff we as citizens don’t want our government leaking:

“One of the exposed files, titled ‘importantAWStokens,’ included the administrative credentials to three Amazon AWS GovCloud servers. Another file exposed in their public GitHub repository — ‘AWS-Workspace-Firefox-Passwords.csv’ — listed plaintext usernames and passwords for dozens of internal CISA systems. According to Caturegli, those system[s] included one called ‘LZ-DSO,’ which appears short for ‘Landing Zone DevSecOps,’ the agency’s secure code development environment.”

Kreb’s source about the information left out in the open was Guillaume Valadon of GitGuardian, a company that scans GitHub for secrets, meaning his business is finding situations like this one. Valadon told Krebs it was “the worst leak that I’ve witnessed in my career.”

#Worst #Leak #Ive #Witnessed #U.S #Cybersecurity #Agency #Leaves #Digital #Keys #Public #GitHubCISA,Github,leaks

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has been leaving the digital keys to its own cloud storage accounts sitting out in the open, in plain text form, for some unknown amount of time, according to a report from Krebs on Security. The problem finally got fixed over the weekend, the report says.

Surely the secret information was buried in some obscure folder with an inscrutable name, I hear you saying. The repository was reportedly named “Private-CISA.”

But there’s no way the contents were that sensitive, you object. But the contents included passwords, keys, and tokens—and the passwords were plain text in a .CSV file.

CISA gave a statement to Krebs, saying the following:

“Currently, there is no indication that any sensitive data was compromised as a result of this incident[…] While we hold our team members to the highest standards of integrity and operational awareness, we are working to ensure additional safeguards are implemented to prevent future occurrences.”

Since the repository was created in November of last year, the duration of the vulnerability seems to have been about six months—but it could have been much shorter depending on what information as added when.

To refresh your memory, CISA is a relatively new branch of the Department of Homeland Security that has had an overall rough time during Trump 2.0, even though, by signing it into law in 2018, Trump actually midwifed CISA into existence during Administration 1.0, and sorry about the tangent, but Trump’s speech to mark the occasion was an exceptional example of Trump poetry, including excerpts like this one:

“The cyber battlespace evolves — and it is evolving, and unfortunately, faster than a lot of people want to talk about. But battlespace it is. So as the cyber battlespace evolves, this new agency will ensure that we confront the full range of threats from nation-states, cyber criminals, and other malicious actors, of which there are many.” 

Incontestably true, Mister President. Battlespace it is.

Anyway, Trump was enraged by information provided by CISA leadership during the period between the 2020 election and January 6, 2021 when he was on a mission to have the election results overturned in his favor. He fired the CISA director he appointed, and since taking office again, his CISA has been a chaotic farce. Neither of the acting directors he’s appointed so far have been confirmed by the Senate, and Trump has recently sought to drastically cut CISA’s funding.

Now, to add to CISA’s worries, it seems, according to one interpretation from the Krebs report on what was in the repository, an individual employee working for a government contractor called Nightwing was using Github to move material from a work device to a home device—sorta like emailing documents to yourself, but somehow even less secure than that.

I’m no expert on federal Cybersecurity, but this from Krebs sounds like stuff we as citizens don’t want our government leaking:

“One of the exposed files, titled ‘importantAWStokens,’ included the administrative credentials to three Amazon AWS GovCloud servers. Another file exposed in their public GitHub repository — ‘AWS-Workspace-Firefox-Passwords.csv’ — listed plaintext usernames and passwords for dozens of internal CISA systems. According to Caturegli, those system[s] included one called ‘LZ-DSO,’ which appears short for ‘Landing Zone DevSecOps,’ the agency’s secure code development environment.”

Kreb’s source about the information left out in the open was Guillaume Valadon of GitGuardian, a company that scans GitHub for secrets, meaning his business is finding situations like this one. Valadon told Krebs it was “the worst leak that I’ve witnessed in my career.”

Source link
#Worst #Leak #Ive #Witnessed #U.S #Cybersecurity #Agency #Leaves #Digital #Keys #Public #GitHub

Today’s Wordle answer should be easy to solve if you’re not put-together.

If you just want to be told today’s word, you can jump to the bottom of this article for today’s Wordle solution revealed. But if you’d rather solve it yourself, keep reading for some clues, tips, and strategies to assist you.

Where did Wordle come from?

Originally created by engineer Josh Wardle as a gift for his partner, Wordle rapidly spread to become an international phenomenon, with thousands of people around the globe playing every day. Alternate Wordle versions created by fans also sprang up, including battle royale Squabble, music identification game Heardle, and variations like Dordle and Quordle that make you guess multiple words at once

Wordle eventually became so popular that it was purchased by the New York Times, and TikTok creators even livestream themselves playing.

What’s the best Wordle starting word?

The best Wordle starting word is the one that speaks to you. But if you prefer to be strategic in your approach, we have a few ideas to help you pick a word that might help you find the solution faster. One tip is to select a word that includes at least two different vowels, plus some common consonants like S, T, R, or N.

What happened to the Wordle archive?

The entire archive of past Wordle puzzles was originally available for anyone to enjoy whenever they felt like it, but it was later taken down, with the website’s creator stating it was done at the request of the New York Times. However, the New York Times then rolled out its own Wordle Archive, available only to NYT Games subscribers.

Is Wordle getting harder?

It might feel like Wordle is getting harder, but it actually isn’t any more difficult than when it first began. You can turn on Wordle‘s Hard Mode if you’re after more of a challenge, though.

Here’s a subtle hint for today’s Wordle answer:

Ruin.

Mashable 101 Fan Fave: Vote for your favorite creators today

Does today’s Wordle answer have a double letter?

There are no recurring letters.

Today’s Wordle is a 5-letter word that starts with…

Today’s Wordle starts with the letter W.

The Wordle answer today is…

Get your last guesses in now, because it’s your final chance to solve today’s Wordle before we reveal the solution.

Drumroll please!

The solution to today’s Wordle is…

WRECK

Don’t feel down if you didn’t manage to guess it this time. There will be a new Wordle for you to stretch your brain with tomorrow, and we’ll be back again to guide you with more helpful hints. Are you also playing NYT Strands? See hints and answers for today’s Strands.

Reporting by Chance Townsend, Caitlin Welsh, Sam Haysom, Amanda Yeo, Shannon Connellan, Cecily Mauran, Mike Pearl, and Adam Rosenberg contributed to this article.

If you’re looking for more puzzles, Mashable’s got games now! Check out our games hub for Mahjong, Sudoku, free crossword, and more.

Not the day you’re after? Here’s the solution to yesterday’s Wordle.

#Wordle #today #answer #hints">Wordle today: The answer and hints for May 20, 2026
                                            
                                                            Today’s Wordle answer should be easy to solve if you’re not put-together.If you just want to be told today’s word, you can jump to the bottom of this article for today’s Wordle solution revealed. But if you’d rather solve it yourself, keep reading for some clues, tips, and strategies to assist you.
        SEE ALSO:
        
            Mahjong, Sudoku, free crossword, and more: Play games on Mashable
            
        
    

        SEE ALSO:
        
            NYT Connections hints today: Clues, answers for May 20, 2026
            
        
    
Where did Wordle come from?Originally created by engineer Josh Wardle as a gift for his partner, Wordle rapidly spread to become an international phenomenon, with thousands of people around the globe playing every day. Alternate Wordle versions created by fans also sprang up, including battle royale Squabble, music identification game Heardle, and variations like Dordle and Quordle that make you guess multiple words at once. Wordle eventually became so popular that it was purchased by the New York Times, and TikTok creators even livestream themselves playing.What’s the best Wordle starting word?The best Wordle starting word is the one that speaks to you. But if you prefer to be strategic in your approach, we have a few ideas to help you pick a word that might help you find the solution faster. One tip is to select a word that includes at least two different vowels, plus some common consonants like S, T, R, or N.What happened to the Wordle archive?The entire archive of past Wordle puzzles was originally available for anyone to enjoy whenever they felt like it, but it was later taken down, with the website’s creator stating it was done at the request of the New York Times. However, the New York Times then rolled out its own Wordle Archive, available only to NYT Games subscribers. Is Wordle getting harder?It might feel like Wordle is getting harder, but it actually isn’t any more difficult than when it first began. You can turn on Wordle‘s Hard Mode if you’re after more of a challenge, though.
        SEE ALSO:
        
            NYT Pips hints, answers for May 20, 2026
            
        
    
Here’s a subtle hint for today’s Wordle answer:Ruin.
        
            Mashable Top Stories
        
        
    
Mashable 101 Fan Fave: Vote for your favorite creators todayDoes today’s Wordle answer have a double letter?There are no recurring letters.Today’s Wordle is a 5-letter word that starts with…Today’s Wordle starts with the letter W.
        SEE ALSO:
        
            Wordle-obsessed? These are the best word games to play IRL.
            
        
    
The Wordle answer today is…Get your last guesses in now, because it’s your final chance to solve today’s Wordle before we reveal the solution.Drumroll please!The solution to today’s Wordle is…WRECKDon’t feel down if you didn’t manage to guess it this time. There will be a new Wordle for you to stretch your brain with tomorrow, and we’ll be back again to guide you with more helpful hints. Are you also playing NYT Strands? See hints and answers for today’s Strands.Reporting by Chance Townsend, Caitlin Welsh, Sam Haysom, Amanda Yeo, Shannon Connellan, Cecily Mauran, Mike Pearl, and Adam Rosenberg contributed to this article.If you’re looking for more puzzles, Mashable’s got games now! Check out our games hub for Mahjong, Sudoku, free crossword, and more.Not the day you’re after? Here’s the solution to yesterday’s Wordle.

                    
                                            
                            
                        
                                    #Wordle #today #answer #hints

Wordle answer should be easy to solve if you’re not put-together.

If you just want to be told today’s word, you can jump to the bottom of this article for today’s Wordle solution revealed. But if you’d rather solve it yourself, keep reading for some clues, tips, and strategies to assist you.

Where did Wordle come from?

Originally created by engineer Josh Wardle as a gift for his partner, Wordle rapidly spread to become an international phenomenon, with thousands of people around the globe playing every day. Alternate Wordle versions created by fans also sprang up, including battle royale Squabble, music identification game Heardle, and variations like Dordle and Quordle that make you guess multiple words at once

Wordle eventually became so popular that it was purchased by the New York Times, and TikTok creators even livestream themselves playing.

What’s the best Wordle starting word?

The best Wordle starting word is the one that speaks to you. But if you prefer to be strategic in your approach, we have a few ideas to help you pick a word that might help you find the solution faster. One tip is to select a word that includes at least two different vowels, plus some common consonants like S, T, R, or N.

What happened to the Wordle archive?

The entire archive of past Wordle puzzles was originally available for anyone to enjoy whenever they felt like it, but it was later taken down, with the website’s creator stating it was done at the request of the New York Times. However, the New York Times then rolled out its own Wordle Archive, available only to NYT Games subscribers.

Is Wordle getting harder?

It might feel like Wordle is getting harder, but it actually isn’t any more difficult than when it first began. You can turn on Wordle‘s Hard Mode if you’re after more of a challenge, though.

Here’s a subtle hint for today’s Wordle answer:

Ruin.

Mashable 101 Fan Fave: Vote for your favorite creators today

Does today’s Wordle answer have a double letter?

There are no recurring letters.

Today’s Wordle is a 5-letter word that starts with…

Today’s Wordle starts with the letter W.

The Wordle answer today is…

Get your last guesses in now, because it’s your final chance to solve today’s Wordle before we reveal the solution.

Drumroll please!

The solution to today’s Wordle is…

WRECK

Don’t feel down if you didn’t manage to guess it this time. There will be a new Wordle for you to stretch your brain with tomorrow, and we’ll be back again to guide you with more helpful hints. Are you also playing NYT Strands? See hints and answers for today’s Strands.

Reporting by Chance Townsend, Caitlin Welsh, Sam Haysom, Amanda Yeo, Shannon Connellan, Cecily Mauran, Mike Pearl, and Adam Rosenberg contributed to this article.

If you’re looking for more puzzles, Mashable’s got games now! Check out our games hub for Mahjong, Sudoku, free crossword, and more.

Not the day you’re after? Here’s the solution to yesterday’s Wordle.

#Wordle #today #answer #hints">Wordle today: The answer and hints for May 20, 2026

Today’s Wordle answer should be easy to solve if you’re not put-together.

If you just want to be told today’s word, you can jump to the bottom of this article for today’s Wordle solution revealed. But if you’d rather solve it yourself, keep reading for some clues, tips, and strategies to assist you.

Where did Wordle come from?

Originally created by engineer Josh Wardle as a gift for his partner, Wordle rapidly spread to become an international phenomenon, with thousands of people around the globe playing every day. Alternate Wordle versions created by fans also sprang up, including battle royale Squabble, music identification game Heardle, and variations like Dordle and Quordle that make you guess multiple words at once

Wordle eventually became so popular that it was purchased by the New York Times, and TikTok creators even livestream themselves playing.

What’s the best Wordle starting word?

The best Wordle starting word is the one that speaks to you. But if you prefer to be strategic in your approach, we have a few ideas to help you pick a word that might help you find the solution faster. One tip is to select a word that includes at least two different vowels, plus some common consonants like S, T, R, or N.

What happened to the Wordle archive?

The entire archive of past Wordle puzzles was originally available for anyone to enjoy whenever they felt like it, but it was later taken down, with the website’s creator stating it was done at the request of the New York Times. However, the New York Times then rolled out its own Wordle Archive, available only to NYT Games subscribers.

Is Wordle getting harder?

It might feel like Wordle is getting harder, but it actually isn’t any more difficult than when it first began. You can turn on Wordle‘s Hard Mode if you’re after more of a challenge, though.

Here’s a subtle hint for today’s Wordle answer:

Ruin.

Mashable 101 Fan Fave: Vote for your favorite creators today

Does today’s Wordle answer have a double letter?

There are no recurring letters.

Today’s Wordle is a 5-letter word that starts with…

Today’s Wordle starts with the letter W.

The Wordle answer today is…

Get your last guesses in now, because it’s your final chance to solve today’s Wordle before we reveal the solution.

Drumroll please!

The solution to today’s Wordle is…

WRECK

Don’t feel down if you didn’t manage to guess it this time. There will be a new Wordle for you to stretch your brain with tomorrow, and we’ll be back again to guide you with more helpful hints. Are you also playing NYT Strands? See hints and answers for today’s Strands.

Reporting by Chance Townsend, Caitlin Welsh, Sam Haysom, Amanda Yeo, Shannon Connellan, Cecily Mauran, Mike Pearl, and Adam Rosenberg contributed to this article.

If you’re looking for more puzzles, Mashable’s got games now! Check out our games hub for Mahjong, Sudoku, free crossword, and more.

Not the day you’re after? Here’s the solution to yesterday’s Wordle.

#Wordle #today #answer #hints

Post Comment